Page MenuHomePhabricator
Create Task
Maniphest T361619

PHP Notice: Key file permissions are not correct, recommend changing to 600 or 660 instead of 644
Closed, ResolvedPublicSecurity
Actions

Description

Error
normalized_message
[{reqId}] {exception_url}   PHP Notice: Key file "file:///tmp/44dfa0e0d4660ebb8f0e791a240f7704510e74f2.key" permissions are not correct, recommend changing to 600 or 660 instead of 644
exception.trace
from /srv/mediawiki/php-1.42.0-wmf.24/vendor/league/oauth2-server/src/CryptKey.php(63)
#0 [internal function]: MWExceptionHandler::handleError(integer, string, string, integer, array)
#1 /srv/mediawiki/php-1.42.0-wmf.24/vendor/league/oauth2-server/src/CryptKey.php(63): trigger_error(string, integer)
#2 /srv/mediawiki/php-1.42.0-wmf.24/vendor/league/oauth2-server/src/ResourceServer.php(50): League\OAuth2\Server\CryptKey->__construct(string)
#3 /srv/mediawiki/php-1.42.0-wmf.24/extensions/OAuth/src/ResourceServer.php(50): League\OAuth2\Server\ResourceServer->__construct(MediaWiki\Extension\OAuth\Repository\AccessTokenRepository, string)
#4 /srv/mediawiki/php-1.42.0-wmf.24/extensions/OAuth/src/ResourceServer.php(39): MediaWiki\Extension\OAuth\ResourceServer->__construct(string, string)
#5 /srv/mediawiki/php-1.42.0-wmf.24/extensions/OAuth/src/SessionProvider.php(107): MediaWiki\Extension\OAuth\ResourceServer::factory()
#6 /srv/mediawiki/php-1.42.0-wmf.24/includes/session/SessionManager.php(539): MediaWiki\Extension\OAuth\SessionProvider->provideSessionInfo(MediaWiki\Request\WebRequest)
#7 /srv/mediawiki/php-1.42.0-wmf.24/includes/session/SessionManager.php(245): MediaWiki\Session\SessionManager->getSessionInfoForRequest(MediaWiki\Request\WebRequest)
#8 /srv/mediawiki/php-1.42.0-wmf.24/includes/Request/WebRequest.php(863): MediaWiki\Session\SessionManager->getSessionForRequest(MediaWiki\Request\WebRequest)
#9 /srv/mediawiki/php-1.42.0-wmf.24/includes/session/SessionManager.php(166): MediaWiki\Request\WebRequest->getSession()
#10 /srv/mediawiki/php-1.42.0-wmf.24/includes/Setup.php(487): MediaWiki\Session\SessionManager::getGlobalSession()
#11 /srv/mediawiki/php-1.42.0-wmf.24/includes/WebStart.php(85): require_once(string)
#12 /srv/mediawiki/php-1.42.0-wmf.24/api.php(37): require(string)
#13 /srv/mediawiki/w/api.php(3): require(string)
#14 {main}
Impact
Notes
  • Making this a sec task out of an abundance of caution

Details

Risk Rating
Medium
Author Affiliation
Wikimedia Communities

Related Objects

Event Timeline

TheresNoTime created this task.Apr 2 2024, 4:05 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 2 2024, 4:05 PM
Reedy added a project: MediaWiki-extensions-OAuth.Apr 2 2024, 4:34 PM
Restricted Application added a project: MediaWiki-Core-Platform-Team. · View Herald TranscriptApr 2 2024, 4:34 PM
sbassett edited projects, added: SecTeam-Processed; removed: Security-Team.Apr 2 2024, 4:39 PM
Reedy subscribed.Apr 2 2024, 4:43 PM

https://github.com/thephpleague/oauth2-server/commit/2f8de3d2302beb490abb9475cf426148801c25c4
https://github.com/thephpleague/oauth2-server/commit/2aca909d203e8a925da8c3a3f16a803683cecf04

https://github.com/thephpleague/oauth2-server/issues/760

I'm guessing this isn't new? Or if it is, is it on k8s?

https://github.com/thephpleague/oauth2-server/issues/760#issuecomment-317701037

Reedy added a comment.Apr 7 2024, 5:45 PM

See also: {T242872} and T244393: OAuth fails CI due to missing RSA tokens

• larissagaulia moved this task from Inbox, needs triage to Waiting on the MediaWiki-Core-Platform-Team board.Apr 8 2024, 3:14 PM
• thcipriani subscribed.Jul 18 2024, 3:55 PM

Still happening as of his week, but only 7 of these errors in 90 days.

Fresh stack trace:

Error
labels.normalized_message
[{reqId}] {exception_url}   PHP Notice: Key file "file:///tmp/44dfa0e0d4660ebb8f0e791a240f7704510e74f2.key" permissions are not correct, recommend changing to 600 or 660 instead of 644
error.stack_trace
from /srv/mediawiki/php-1.43.0-wmf.11/vendor/league/oauth2-server/src/CryptKey.php(63)
#0 [internal function]: MWExceptionHandler::handleError(integer, string, string, integer, array)
#1 /srv/mediawiki/php-1.43.0-wmf.11/vendor/league/oauth2-server/src/CryptKey.php(63): trigger_error(string, integer)
#2 /srv/mediawiki/php-1.43.0-wmf.11/vendor/league/oauth2-server/src/ResourceServer.php(50): League\OAuth2\Server\CryptKey->__construct(string)
#3 /srv/mediawiki/php-1.43.0-wmf.11/extensions/OAuth/src/ResourceServer.php(50): League\OAuth2\Server\ResourceServer->__construct(MediaWiki\Extension\OAuth\Repository\AccessTokenRepository, string)
#4 /srv/mediawiki/php-1.43.0-wmf.11/extensions/OAuth/src/ResourceServer.php(39): MediaWiki\Extension\OAuth\ResourceServer->__construct(string, string)
#5 /srv/mediawiki/php-1.43.0-wmf.11/extensions/OAuth/src/SessionProvider.php(107): MediaWiki\Extension\OAuth\ResourceServer::factory()
#6 /srv/mediawiki/php-1.43.0-wmf.11/includes/session/SessionManager.php(542): MediaWiki\Extension\OAuth\SessionProvider->provideSessionInfo(MediaWiki\Request\WebRequest)
#7 /srv/mediawiki/php-1.43.0-wmf.11/includes/session/SessionManager.php(248): MediaWiki\Session\SessionManager->getSessionInfoForRequest(MediaWiki\Request\WebRequest)
#8 /srv/mediawiki/php-1.43.0-wmf.11/includes/Request/WebRequest.php(870): MediaWiki\Session\SessionManager->getSessionForRequest(MediaWiki\Request\WebRequest)
#9 /srv/mediawiki/php-1.43.0-wmf.11/includes/session/SessionManager.php(167): MediaWiki\Request\WebRequest->getSession()
#10 /srv/mediawiki/php-1.43.0-wmf.11/includes/Setup.php(489): MediaWiki\Session\SessionManager::getGlobalSession()
#11 /srv/mediawiki/php-1.43.0-wmf.11/includes/WebStart.php(85): require_once(string)
#12 /srv/mediawiki/php-1.43.0-wmf.11/api.php(37): require(string)
#13 /srv/mediawiki/w/api.php(3): require(string)
#14 {main}

Noting that there is no error about chmod from PHP (which it sounds like is what the library does). Only a failure for permissions after the chmod.

Tgr subscribed.Jan 19 2026, 9:31 PM

Still happening: https://logstash.wikimedia.org/goto/98a58026f6948432b459da51767d6afa

Tgr added a comment.Jan 20 2026, 2:00 PM

PrivateSettings.php is 664 so security-wise this doesn't really make any difference. In any case the weird workaround of writing in-memory keys to tempfiles is removed in recent versions of oauth2-server so the pending upgrade will resolve this.

Tgr edited projects, added: MediaWiki-Core-Platform-Team (Kanban); removed: MediaWiki-Core-Platform-Team.Jan 20 2026, 2:00 PM
Tgr moved this task from Essential Work to In Progress on the MediaWiki-Core-Platform-Team (Kanban) board.
Tgr moved this task from In Progress to To be verified in Prod on the MediaWiki-Core-Platform-Team (Kanban) board.Feb 16 2026, 4:00 PM
matmarex closed this task as Resolved.Feb 23 2026, 3:49 PM
matmarex subscribed.

Looks resolved, last error was on 11 February.

matmarex added a subscriber: sbassett.Feb 23 2026, 4:11 PM

I think this task can be made public now. @sbassett (or anyone else with the permissions) Could you do the honors?

In any case the weird workaround of writing in-memory keys to tempfiles is removed in recent versions of oauth2-server so the pending upgrade will resolve this.

This was done in https://gerrit.wikimedia.org/r/c/mediawiki/vendor/+/1229647 and related patches.

sbassett added a comment.Feb 23 2026, 4:14 PM
In T361619#11641238, @matmarex wrote:

I think this task can be made public now. @sbassett (or anyone else with the permissions) Could you do the honors?

This was done in https://gerrit.wikimedia.org/r/c/mediawiki/vendor/+/1229647 and related patches.

Sounds good, thanks.

sbassett triaged this task as Medium priority.Feb 23 2026, 4:14 PM
sbassett changed Author Affiliation from N/A to Wikimedia Communities.
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to Medium.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits